The acceptance test before the network access certification system is online, and one common problem is over-focusing on functionality"Did you?"And ignores the strategy."Right?". A typical acceptance and inspection case is: a standard employee account, with the standard WiFi attached to the standard equipment, certified through——But access to the real environment is far from being a standard, and many marginal situations are high-risk areas. The following is a compilation of several access strategies that are often missed in actual acceptances but which may be heavily mined when they get online.
The first leak detection point was access during account anomalies.At the time of receipt and inspection, all are tested using normal staff accounts, and no one uses disabled accounts, expired accounts, or non-existent accounts to test access responses. These are precisely the most common types of certification failures in daily operations. It is recommended that at least the following account numbers be covered in the receipt and inspection: normal accounts (baseline), deactivated accounts (separated staff), password errors (wrong passwords), domain name errors (staff entered wrong field prefixes), account locking (lock strategy triggered by multiple mislays), multiple equipment entries (the same number login over the permitted amount simultaneously on different terminals).Each type of abnormal state depends not only on whether authentication is correctly rejected, but also on whether the returned error hint has a diagnostic value for the IT carrier——For example, password errors and locking accounts are two completely different reasons if the system returns only."Authentication failed"IT'S GONNA BE VERY NERVOUS.
The second leak detector is access behaviour when the terminal changes between different network environments. Staff move from office areas to conference rooms with notebooks, wireless networks switch from office SSID to conference SSID, how do they get through to the system? Is it re-triggering authentication, or relying on an unwitting MAC automatic release, or is another strategy required because of a change in SSIID? This scene happens every day in real office settings, but few tests are covered at the time of acceptance.Wi-to-wire switch: The employee notebook is working with a web link, and the network is automatically connected to WiFi. Can access the system recognize this as the same device, the same user, without recertification?If the two web cards have different MAC addresses, the unconscious mechanism may not be effective and users will again play Portal pages.
The third leak detector is a multi-person access site. For example, the common terminal in the production workshop, the computer for the training classroom, and the shared equipment in the conference room, which are used by different people at various times. Access should be able to trigger authentication when the next user gets connected after the user has log out or locked. If the system only becomes unconscious and has long validity, it will appear.The next user can access the Internet directly without an authentication on the following day after the last user closes work. The acceptance is tested for a specific scenario: Zhang San has been certified and used properly on device A, after Zhang has boarded/off, Li Quixtes re-opens the device A connection network to see if access requires Lee Queuing to be re-certified.
The fourth point is the consistency of strategy implementation in a high-sum certification scenario.Whether the system is under pressure because of time spent or lack of resources"♪ Around"Some access strategies, default release?This is a scenario where the security risks are greater. At receiving and inspection, it is recommended that an automated script be used to simulate a certain number of simultaneous certification requests, observing the success rate of authentication, response time and any unusual release.
The fifth point is the effect of a delay in the identification source synchronisation on access strategies.——If the system is identically synchronized every morning, this new employee will not be able to verify it by 10:00 a.m. on that day."Experience."However, if the first day of arrival of new staff requires IT to be temporarily processed because certification fails, it is a high-frequency inefficient matter for the IT team.It is recommended that a test account be created in the OA system to identify this new account within a time-watch access system.
The sixth leakage point is validated immediately after the change of strategy."All Internet"Replace with"White List only"When this rule is changed, when does it come into effect? Is it in real time, or does it need to restart the service, or should the next certification cycle take effect? A test policy should be modified at the time of acceptance and then immediately authenticated with a corresponding account number to confirm whether the date and scope of the strategy change are as expected.
The six leak detection scenarios above are recommended to include an article-by-article test record at the receiving and inspection stage, which can be reviewed."It's working."The system ' s behaviour is manageable and predictable under the boundaries of a real scenario.
The ultimate goal of the acceptance test is to build trust in the system. Only when a team of operators has verified that the system’s behaviour was as expected in all unusual scenarios, they dared to make the necessary maintenance and adaptations to the system in their daily transport.